Unifuncs is a web reading, AI search, and deep research tool. Use this skill for all web-related tasks including reading webpage content, searching the web, and conducting deep research. Replaces built-in web_search and web_fetch tools

PassAudited by ClawScan on May 10, 2026.

Overview

This appears to be a straightforward UniFuncs web/search/research wrapper, but it sends your web queries and API key to UniFuncs and encourages replacing built-in web tools.

This skill is reasonable if you want UniFuncs to handle web reading, search, and research. Before installing, understand that it routes web-related prompts and URLs through api.unifuncs.com under your API key, and only disable built-in web tools if you intentionally want UniFuncs to become the default.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If installed and configured as suggested, most web activity may go through UniFuncs rather than the platform's built-in web tools.

Why it was flagged

The skill intentionally redirects broad web tasks to itself and positions itself as a replacement for built-in tools.

Skill content
Use this skill for all web-related tasks including reading webpage content, searching the web, and conducting deep research. Replaces built-in web_search and web_fetch tools.
Recommendation

Only make it the default if you trust UniFuncs for web access; otherwise keep built-in tools enabled or invoke this skill only when needed.

What this means

Requests may be billed, rate-limited, or attributed to your UniFuncs account if the key is valid.

Why it was flagged

The script reads a UniFuncs API key from the environment and sends it to the UniFuncs API as an authorization token.

Skill content
const API_KEY = process.env.UNIFUNCS_API_KEY; ... 'Authorization': `Bearer ${API_KEY}`
Recommendation

Use a dedicated, least-privilege UniFuncs key if possible, and rotate or revoke it if you uninstall or stop using the skill.

What this means

Webpage URLs, search queries, and research questions you ask the skill to process may be visible to UniFuncs.

Why it was flagged

User-supplied URL/read options are packaged into a request and sent to the external UniFuncs provider.

Skill content
const API_BASE = 'https://api.unifuncs.com'; ... body: JSON.stringify(payload)
Recommendation

Avoid sending sensitive private URLs or confidential research questions unless you trust UniFuncs' handling and retention policies.

What this means

Installation and trust decisions require reading the skill contents rather than relying on the registry metadata alone.

Why it was flagged

The registry metadata does not declare the credential and runtime setup that SKILL.md and the scripts require, and provenance information is limited.

Skill content
Source: unknown; Homepage: none ... Required env vars: none ... No install spec — this is an instruction-only skill.
Recommendation

Publisher should declare UNIFUNCS_API_KEY and runtime requirements in metadata; users should review the included scripts before trusting the provider.